| Titre | mf-yang openclaw-cn 0.2.1 Improper Link Resolution Before File Access (CWE-59) |
|---|
| Description | # Technical Details
An Improper Link Resolution vulnerability exists in OpenClaw's `apply_patch` tool. The tool is documented as workspace-contained by default, but its path guard can be bypassed via a dangling symlink. In `src/agents/sandbox-paths.ts`, `assertNoSymlinkEscape()` walks path components with `lstat()`. When the final leaf lookup hits `ENOENT` (file does not exist yet, as with `Add File:` patches), the function returns success immediately instead of resolving from the nearest existing ancestor. This means a dangling symlink leaf inside the workspace is not validated. In `src/agents/apply-patch.ts`, `applyPatch()` then performs `fs.writeFile()` on the symlink path, and the OS follows the dangling symlink target outside the workspace root. The tool is exposed via `src/agents/pi-tools.ts` when `tools.exec.applyPatch.enabled` is set and an allowed OpenAI model is used.
# Vulnerable Code
File: src/agents/sandbox-paths.ts (lines 101-139)
Method: assertNoSymlinkEscape()
Why: Returns success on `isNotFoundPathError(err)` without resolving a dangling final symlink leaf through the nearest existing ancestor.
File: src/agents/apply-patch.ts (lines 149-152)
Method: applyPatch()
Why: Uses the validated target path from `resolvePatchPath()` and immediately performs `fs.writeFile()`, so any unresolved dangling symlink alias is followed by the OS at write time.
File: src/agents/pi-tools.ts (lines 237-245, 309-317)
Method: createOpenClawCodingTools()
Why: Enables `apply_patch` for OpenAI models when configured, making the vulnerable file-write surface reachable in normal embedded agent sessions.
# Reproduction
1. Enable `tools.exec.applyPatch.enabled` in an OpenClaw deployment.
2. Create a dangling symlink inside the workspace: `workspace/jump -> /tmp/outside/owned.txt`.
3. Invoke `apply_patch` with `*** Add File: jump` containing attacker-controlled content.
4. Observe the outside file now contains the patch content despite being outside the workspace root.
5. Confirm direct `../escape.txt` traversal is correctly rejected, proving the bypass is symlink-specific.
# Impact
- Filesystem boundary bypass on the embedded agent tool surface.
- Any deployment relying on `workspaceOnly=true` can be tricked into creating or overwriting files outside the workspace root.
- Can corrupt adjacent project files, host-side config, scripts, or other mounted content.
- Breaks the advertised confinement guarantee for a mutating file tool. |
|---|
| La source | ⚠️ https://github.com/mf-yang/openclaw-cn/issues/565 |
|---|
| Utilisateur | TrumpChen (UID 99092) |
|---|
| Soumission | 18/06/2026 09:59 (il y a 2 mois) |
|---|
| Modérer | 05/08/2026 22:04 (2 months later) |
|---|
| Statut | Dupliqué |
|---|
| Entrée VulDB | 386391 [mf-yang openclaw-cn jusqu’à 0.2.1 apply_patch Tool sandbox-paths.ts assertNoSymlinkEscape élévation de privilèges] |
|---|
| Points | 0 |
|---|